4 ms·

Yeah, how's that GDPR working out? I feel like it was meant to do more than spur blog posts such as this one

Nextgrid 6y ago
The spirit of it is good, the enforcement has been significantly lacking and the regulators who are supposed to enforce it appear incompetent or unwilling to do so.
- draw_down 6y ago
  Ah, well, as long as the spirit is good.
SiempreViernes 6y ago
You can check here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
- Nextgrid 6y ago
  That link gets posted all the time, often as a rebuttal to the "no enforcement" claim but the web being littered by non-compliant tracking consent flows clearly shows there is not enough enforcement. As a reminder, I don't believe the majority of consent flows on the web are compliant with the regulation. As per the ICO's guidelines (the UK data protection regulator) https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...: > Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. > Keep your consent requests separate from other terms and conditions. > Make it easy for people to withdraw consent and tell them how. > Avoid making consent to processing a precondition of a service. The majority of consent flows out there don't comply with at least one of these points, so the fact they're still out there 3 years after the regulation went into effect suggests enforcement is indeed lacking.
Daho0n 6y ago
Not perfect but much much better than before. I can give you two personal examples of how even small stuff that used to be ignored now demand attention: I installed a game that had a bug (opt-in to tracking wasn't working so tracking was always on). Lots and lots of users complained in the game developers forum but nothing happened. Not even a reply. I and a few others wrote emails to the support mail and nothing. Then I threatened with GDPR months later and two days later support was on my case and my data was deleted from both their system and the third party they used for tracking. Here in Denmark businesses aren't allowed to receive updates from the CPR registry (like SSN) if you aren't a customer anymore. It's used for stuff like banks automatically getting your new address if you move. Historically sending mails to those that didn't remove you from their updates didn't do anything. Now they run quickly as soon as they read "GDPR". There are big businesses that get away with things they shouldn't but by far the most problems can now be resolved, even small stuff that big businesses before didn't lift a finger to fix where the little man had no chance in hell. Now they (we!) do.

The spirit of it is good, the enforcement has been significantly lacking and the regulators who are supposed to enforce it appear incompetent or unwilling to do so.

draw_down 6y ago
Ah, well, as long as the spirit is good.

SiempreViernes 6y ago

You can check here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/

Nextgrid 6y ago
That link gets posted all the time, often as a rebuttal to the "no enforcement" claim but the web being littered by non-compliant tracking consent flows clearly shows there is not enough enforcement. As a reminder, I don't believe the majority of consent flows on the web are compliant with the regulation. As per the ICO's guidelines (the UK data protection regulator) https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio...: > Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent. > Keep your consent requests separate from other terms and conditions. > Make it easy for people to withdraw consent and tell them how. > Avoid making consent to processing a precondition of a service. The majority of consent flows out there don't comply with at least one of these points, so the fact they're still out there 3 years after the regulation went into effect suggests enforcement is indeed lacking.

Daho0n 6y ago

Not perfect but much much better than before. I can give you two personal examples of how even small stuff that used to be ignored now demand attention: I installed a game that had a bug (opt-in to tracking wasn't working so tracking was always on). Lots and lots of users complained in the game developers forum but nothing happened. Not even a reply. I and a few others wrote emails to the support mail and nothing. Then I threatened with GDPR months later and two days later support was on my case and my data was deleted from both their system and the third party they used for tracking. Here in Denmark businesses aren't allowed to receive updates from the CPR registry (like SSN) if you aren't a customer anymore. It's used for stuff like banks automatically getting your new address if you move. Historically sending mails to those that didn't remove you from their updates didn't do anything. Now they run quickly as soon as they read "GDPR". There are big businesses that get away with things they shouldn't but by far the most problems can now be resolved, even small stuff that big businesses before didn't lift a finger to fix where the little man had no chance in hell. Now they (we!) do.